Restricting User Access in XP

bazpaul

Hey all security experts! I need advice!!!

I have had experiences in the past of the damage that can be done to computers when shared among friends and especially students with all there downloading, web surfing habits and eagerness to install unnecessary crap!!

Thus i have recently acquired a new laptop and theres not a sniff of me allowing any computer-tards to mess it up! So im gonna setup two accounts on windows, ADMIN and COMPUTER_TARDS. To save any rows im probably gonna call the computer_tard account the GUEST account. So here is so of my questions?

I have been using the group policy editor to restrict access to lots of stuff, drives, ctrl panel...etc However i am a bit of a tard myself and cannot find the difference between the ADMIN account and GUEST account when using gpedit.

1: In gpedit under UserCon..\AdminTemp... when you change access to programs and mess around with windows components, how do i only specify these changes for the guest account?? Basically I do want to change anythin in the GP editor for the ADMIN account but wanna change everything for the guest account!

2: When using the ADMN account one can set security access to any folder by right clicking and going to security tab. Is this the best way to restrict acess to certain folders?? Basically i dont want anyone to save to c:\ drive or anywhere on PC at all except for there MyDocuments folder.

3. I also might want to restrict access to people changing the start menu, or basically any settings on the start bar abd desktop. Can this be done?

4. I'm also seeking advice about protecting users from visiting unreliable (xxx, spyware, adware) sites! Because basically you tell people that they'll f*ck ur computer if they visit these sites, but no-one cares until your computer is virus ridden and unusable! I was thinkin of installing something like NetNanny. Is this a good website blocker? can anyone suggest any better? Also i suppose you can restrict the GUEST account from making any changes in NetNanny while the admin can change everything!

5. Finally, is this the best way to go about protecting ur computer? i was thinkin of doin away with the guest account and just creating another user, but restricting that using gpedit.msc


All i want is for the GUEST user to use the internet + some office programs + some games + be able to save to their MyDocuments folder. Everything else i want to restrict!!!

Any help, or helpful websites would be greatly appreciated. I couldnt find much sites in the way of 'User Policy'

cheers in advance

kippy

http://www.windowsecurity.com/articles/Windows_XP_Your_Definitive_Lockdown_Guide.html
and here:
http://blogs.chron.com/techblog/archives/2005/06/lock_down_windo.html

I am not sure if they are exactly what you are looking for but I'd say parts of it would be useful.
Kippy

irlrobins

Moving to windows

Capt'n Midnight

lookup Kiosk mode too

if they have physical access they can control the machine, so bios passwords etc. so CD / Floppy / USB aren't bootable.

if you have broadband you could just disable the HDD and let them use bootable CD's ( bypassing windows completely )

bazpaul

yeh thanks capt, not much help there. I know a computer is never fully locked down. But as i stated these are computer tards, i dont think any of them are gonna go to the effort of gettin a password reset disc let alone would they know where to get one.

Found good help at securityforums.com

Was suggested to use Faronics - Deep Freeze

http://www.faronics.com/html/deepfreeze.asp